Call Admission Control for IKE

The Call Admission Control for IKE feature describes the application of Call Admission Control (CAC) to the Internet Key Exchange (IKE) protocol in Cisco IOS software. CAC limits the number of simultaneous IKE and IPsec security associations (SAs) that is, calls to CAC that a router can establish.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see
Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to
www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Prerequisites for Call Admission Control for IKE

Information About Call Admission Control for IKE

IKE Session

There are two ways to limit the number of Internet Key Exchange (IKE) security associations (SAs) that a device can establish to or from another device:

Configure the absolute IKE SA limit by entering the
cryptocalladmissionlimit command. The device drops new IKE SA requests when the configured limit is reached.

Configure the system resource limit by entering the
calladmissionlimit command. The device drops new IKE SA requests when the level of system resources that are configured in the unit of charge is being used.

Call Admission Control (CAC) is applied only to new SAs (that is, when an SA does not already exist between peers). Every effort is made to preserve existing SAs. New SA requests are denied due to a lack of system resources or because the configured IKE SA limit is reached.

Security Association Limit

An SA is a description of how two or more entities will utilize security services to communicate securely on behalf of a particular data flow. IKE requires and uses SAs to identify the parameters of its connections. IKE can negotiate and establish its own SA. An IKE SA is used by IKE only, and it is bidirectional. An IKE SA cannot limit IPsec.

IKE drops SA requests based on a user-configured SA limit. To configure an IKE SA limit, enter the cryptocalladmissionlimit command. When there is a new SA request from a peer router, IKE determines whether the number of active IKE SAs plus the number of SAs being negotiated meets or exceeds the configured SA limit. If the number is greater than or equal to the limit, the new SA request is rejected and a syslog is generated. This log contains the source destination IP address of the SA request.

The ipsecsanumber and ikesanumber keyword and argument pairs in the cryptocalladmissionlimitcommand set the limit for the number of established IPsec SAs and IKE SAs.

Limit on Number of In-Negotiation IKE Connections

You can limit the number of in-negotiation IKE connections that can be configured on a device based on your Cisco release. This type of IKE connection represents either an aggressive mode IKE SA or a main mode IKE SA prior to its authentication and actual establishment. The default value for maximum in-negotiation CAC for IKEv2 is 40.

You can use the
cryptocalladmissionlimitikein-negotiation-sa number command to specify the maximum number of Internet Key Exchange (IKE) and IPsec security associations (SAs) that the device can establish before IKE begins rejecting the new SA requests.

The
allin-negotiation-sa number and
ikein-negotiation-sa number keyword and argument pairs in the
cryptocalladmissionlimit command limit all SAs in negotiation and IKE SAs in negotiation.

System Resource Usage

CAC polls a global resource monitor so that IKE knows when the router is running short of CPU cycles or memory buffers. You can configure a limit, in the range 1 to 100000, that represents the level of system resource usage in system resource usage units. When that level of resources is being used, IKE drops (will not accept new) SA requests. To configure the system resource usage limit, enter the calladmissionlimit command.

For each incoming new SA request, the current load on the router is converted into a numerical value, representing the system resource usage level, and is compared to the resource limit set by the calladmissionlimit command. If the current load is more than the configured resource limit, IKE drops the new SA request. Load on the router includes active SAs, CPU usage, and SA requests being considered.

The calladmissionload command configures a multiplier value from 0 to 1000 that represents a scaling factor for current system resource usage and a load metric poll rate of 1 to 32 seconds. The numerical value for the system resource usage level is calculated by the formula (scaling factor * current system resource usage) / 100. It is recommended that thecalladmissionload command not be used unless advised by a Cisco Technical Assistance Center (TAC) engineer.

MIBs

RFCs

RFCs

Title

RFC 2409

The Internet Key Exchange

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Feature Information for Call Admission Control for IKE

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to
www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Table 1 Feature Information for Call Admission Control for IKE

Feature Name

Releases

Feature Information

Call Admission Control for IKE

12.3(8)T 12.2(18)SXD1 12.4(6)T 12.2(33)SRA 12.2(33)SXH

The Call Admission Control for IKE feature describes the application of Call Admission Control (CAC) to the Internet Key Exchange (IKE) protocol in Cisco IOS software.

In Cisco IOS Release 12.3(8)T, this feature was introduced.

This feature was integrated into Cisco IOS Release 12.2(18)SXD1 and implemented on the Cisco 6500 and Cisco 7600 routers.

In Cisco IOS Release 12.4(6)T, the ability to configure a limit on the number of in-negotiation IKE connections was added.

The following sections provide information about this feature:

The following commands were introduced or modified:
calladmissionlimit,clearcryptocalladmissionstatistics,cryptocalladmissionlimit,showcalladmissionstatistics,showcryptocalladmissionstatistics.

IKEv1 Hardening

15.1(3)T

The IKEv1 hardening feature describes the enhancements made to the Call Admission Control (CAC) for IKE feature.

In Cisco IOS Release 15.1(3)T, this feature was introduced.

The following sections provide information about this feature:

The following commands were introduced or modified:
cryptocalladmissionlimit,showcryptocalladmissionstatistics.